@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/helpers/drivers.js

@@ -153,17 +153,20 @@ function _makeFakeMysqlDriver() {
         return { rows: [], affectedRows: 1 };
       }
 
-      // UPDATE _blamejs_leader SET `expiresAt` = ?, `endpoint` = ?
-      // WHERE `scope` = ? AND `nodeId` = ? AND `leaseId` = ?  (renew).
-      // The provider composes this through b.sql: identifiers are
-      // backtick-quoted and the scope value binds (params[2]='leader')
-      // ahead of nodeId (params[3]) / leaseId (params[4]).
-      var renewMatch = /^UPDATE _blamejs_leader SET[\s\S]*`?expiresAt`? = \?[\s\S]*`?endpoint`? = \?[\s\S]*WHERE `?scope`? = \? AND `?nodeId`? = \? AND `?leaseId`? = \?/i.test(t);
+      // UPDATE _blamejs_leader SET `acquiredAt` = ?, `expiresAt` = ?,
+      // `endpoint` = ? WHERE `scope` = ? AND `nodeId` = ? AND `leaseId` = ?
+      // (renew). The renewal slides acquiredAt forward alongside expiresAt
+      // so the lease span stays the configured TTL. b.sql binds the SET
+      // values first (acquiredAt=params[0], expiresAt=params[1],
+      // endpoint=params[2]) then the WHERE (scope=params[3]='leader',
+      // nodeId=params[4], leaseId=params[5]).
+      var renewMatch = /^UPDATE _blamejs_leader SET[\s\S]*`?acquiredAt`? = \?[\s\S]*`?expiresAt`? = \?[\s\S]*`?endpoint`? = \?[\s\S]*WHERE `?scope`? = \? AND `?nodeId`? = \? AND `?leaseId`? = \?/i.test(t);
       if (renewMatch) {
         var r = rows._blamejs_leader;
-        if (r && r.nodeId === params[3] && r.leaseId === params[4]) {
-          r.expiresAt = params[0];
-          r.endpoint  = params[1];
+        if (r && r.nodeId === params[4] && r.leaseId === params[5]) {
+          r.acquiredAt = params[0];
+          r.expiresAt  = params[1];
+          r.endpoint   = params[2];
           return { rows: [], affectedRows: 1 };
         }
         return { rows: [], affectedRows: 0 };

package/lib/vendor/blamejs/test/integration/audit-stack-mysql.test.js

@@ -13,7 +13,10 @@
  *   lib/chain-writer.js — _insertRow / counter primer / tip read on MySQL
  *   lib/break-glass.js  — policy.set/get/list (ON DUPLICATE KEY UPSERT) +
  *                         grant + unsealRow consume (the backtick-quoted
- *                         rowsConsumed increment), routed to live MySQL
+ *                         rowsConsumed increment), routed to live MySQL,
+ *                         including the concurrent double-claim refusal on
+ *                         a 1-row grant (affected-row-count claim across
+ *                         separate autocommit connections)
  *   lib/crypto-field.js — a K_row (vault.row:) sealed cell stored as TEXT in
  *                         MySQL and read back + derived-hash dual-read
  *
@@ -296,6 +299,7 @@ async function run() {
     await _testCoercionFidelity();
     await _testAuditToolsBundle(tmpDir);
     await _testBreakGlass();
+    await _testBreakGlassConcurrentDoubleClaim();
     await _testCryptoFieldKRowRoundTrip();
     await _testDerivedHashDualRead();
     await _testTamperDetection();
@@ -524,6 +528,91 @@ async function _testBreakGlass() {
     Array.isArray(active) && active.length === 0);
 }
 
+// ====================================================================
+// 5b. break-glass concurrent double-claim — TWO in-flight unsealRow calls
+//     redeeming the SAME 1-row grant against DIFFERENT rows must admit
+//     exactly ONE on live MySQL. The claim is the single-statement atomic
+//     UPDATE ... SET rowsConsumed = rowsConsumed + 1 WHERE rowsConsumed <
+//     maxRowsPerGrant, and the AFFECTED-ROW COUNT (ROW_COUNT() read in the
+//     SAME shim invocation as the DML — connection-consistent) is the
+//     per-caller win/lose signal. On this per-statement shim every
+//     statement is its own real MySQL connection and autocommit
+//     transaction — exactly the shape the claim must survive: unlike the
+//     FOR-UPDATE-SKIP-LOCKED lease flows (whose cross-statement locks the
+//     stateless shim cannot hold), the claim holds no lock across
+//     statements, so the shim exercises it faithfully. The two callers
+//     advance in lockstep (identical await chains launched in the same
+//     tick; every shim statement is synchronous, so neither caller can
+//     run its whole flow before the other's first read) — both pre-flight
+//     grant reads observe rowsConsumed = 0, then the two claim UPDATEs
+//     land as two separate transactions and InnoDB re-evaluates the
+//     loser's WHERE against the winner's committed increment: 0 affected
+//     rows. (A held-lock barrier like the Postgres file's is impossible
+//     here: a blocked UPDATE inside the execFileSync shim would freeze
+//     the event loop against the lock we'd need to release.) Inferring
+//     the claim from a re-read of rowsConsumed instead admits BOTH
+//     callers (the winner's increment is visible to the loser's re-read),
+//     unsealing two regulated records under a maxRowsPerGrant:1 grant.
+// ====================================================================
+async function _testBreakGlassConcurrentDoubleClaim() {
+  // A second glass-locked row so the two redemptions target DIFFERENT
+  // rows — a same-row retry can't mask a double-spend.
+  var patient2 = b.cryptoField.sealRow("patients", {
+    _id: "patient-002", mrn: "MRN-2", ssn: "987-65-4321",
+    residency: "eu", notes: "type 2 diabetes",
+  });
+  await b.clusterStorage.execute(
+    "INSERT INTO `patients` (`_id`,`mrn`,`ssn`,`residency`,`notes`) VALUES (?,?,?,?,?)",
+    [patient2._id, patient2.mrn, patient2.ssn, patient2.residency, patient2.notes]);
+
+  // Fresh 1-row grant — the policy from the previous section already pins
+  // maxRowsPerGrant: 1 (row-by-row auth).
+  var totpSecret = b.auth.totp.generateSecret();
+  var nowMs = Date.now();
+  var code = b.auth.totp.generate(totpSecret, { now: nowMs });
+  var req = {
+    user: { id: "dr-house", scopes: [] }, socket: { remoteAddress: "127.0.0.1" },
+    headers: { "user-agent": "test-agent" }, method: "POST", url: "/admin/break-glass",
+  };
+  var handle = await b.breakGlass.grant({
+    req: req, table: "patients", columns: ["ssn"],
+    reason: "ER admit disambiguating two candidate records",
+    factor: { type: "totp", secret: totpSecret, code: code, now: nowMs },
+  });
+  check("break-glass double-claim (mysql): fresh 1-row grant minted (rowsRemaining 1)",
+    handle && handle.rowsRemaining === 1);
+
+  var results = await Promise.allSettled([
+    b.breakGlass.unsealRow(handle, "patients", "patient-001"),
+    b.breakGlass.unsealRow(handle, "patients", "patient-002"),
+  ]);
+  var ok  = results.filter(function (r) { return r.status === "fulfilled"; });
+  var bad = results.filter(function (r) { return r.status === "rejected"; });
+  check("break-glass double-claim (mysql): exactly ONE of two concurrent unseals " +
+    "succeeded under the 1-row grant on live MySQL",
+    ok.length === 1 && bad.length === 1);
+  check("break-glass double-claim (mysql): the winner decrypted its glass-locked ssn",
+    ok.length === 1 &&
+    (ok[0].value.ssn === "123-45-6789" || ok[0].value.ssn === "987-65-4321"));
+  var loser = bad.length === 1 ? bad[0].reason : null;
+  check("break-glass double-claim (mysql): the loser is refused as grant-exhausted",
+    loser !== null && /breakglass\/grant-exhausted/.test(String((loser && loser.code) || "")));
+  // The loser must lose AT THE ATOMIC CLAIM ("exhausted by a concurrent
+  // read" — 0 affected rows), NOT at the pre-flight counter check ("has
+  // consumed all ... allowed rows") — the pre-flight path never raced. A
+  // re-read-based claim admits both callers and neither message appears.
+  check("break-glass double-claim (mysql): the loser was refused by the affected-" +
+    "row-count claim, not the pre-flight check [loser: " +
+    String(loser && loser.message) + "]",
+    loser !== null &&
+    /exhausted by a concurrent read/.test(String((loser && loser.message) || "")));
+
+  check("break-glass double-claim (mysql): rowsConsumed on MySQL is exactly 1 — " +
+    "the 1-row grant was spent once, not twice",
+    Number(_scalar("SELECT `rowsConsumed` FROM `_blamejs_break_glass_grants` " +
+      "WHERE `_id` = '" + handle.id + "'")) === 1);
+}
+
 // ====================================================================
 // 6. crypto-field K_row (vault.row:) sealed cell stored on MySQL + read
 //    back, proving the typed codec survives a real TEXT round-trip. The

package/lib/vendor/blamejs/test/integration/audit-stack-postgres.test.js

@@ -12,7 +12,10 @@
  *   lib/chain-writer.js — _insertRow / counter primer / tip read on a real
  *                         backend
  *   lib/break-glass.js  — policy.set/get/list + grant + unsealRow consume,
- *                         all routed through clusterStorage to live Postgres
+ *                         all routed through clusterStorage to live Postgres,
+ *                         including the concurrent double-claim refusal on a
+ *                         1-row grant (affected-row-count claim under real
+ *                         row locking on two parallel sessions)
  *   lib/crypto-field.js — a K_row (vault.row:) sealed cell stored as TEXT in
  *                         Postgres and read back, proving the typed codec
  *                         (Buffer/object) survives a real round-trip
@@ -341,6 +344,7 @@ async function run() {
     await _testCoercionFidelity(liveQueryAll);
     await _testAuditToolsBundleAndPurge(tmpDir);
     await _testBreakGlass();
+    await _testBreakGlassConcurrentDoubleClaim(driver);
     await _testCryptoFieldKRowRoundTrip(liveQueryAll);
     await _testTamperDetection();
 
@@ -708,6 +712,123 @@ async function _testBreakGlass() {
         exhaustedErr && /exhausted/i.test((exhaustedErr.code || "") + (exhaustedErr.message || "")));
 }
 
+// ====================================================================
+// 5b. break-glass concurrent double-claim — TWO in-flight unsealRow calls
+//     redeeming the SAME 1-row grant against DIFFERENT rows must admit
+//     exactly ONE. The claim is the atomic UPDATE ... SET rowsConsumed =
+//     rowsConsumed + 1 WHERE rowsConsumed < maxRowsPerGrant, and the
+//     AFFECTED-ROW COUNT is the per-caller win/lose signal — under real
+//     Postgres row locking, on two SEPARATE pooled psql sessions
+//     (concurrency the single-connection node:sqlite layer-0 run cannot
+//     produce). A dedicated holder session takes FOR UPDATE on the grant
+//     row so BOTH claim UPDATEs park behind it while both callers'
+//     pre-flight reads (MVCC snapshot reads — not blocked) observe
+//     rowsConsumed = 0; releasing the lock lets Postgres serialize the
+//     two UPDATEs — the loser re-evaluates its WHERE against the winner's
+//     committed increment and changes 0 rows. Inferring the claim from a
+//     re-read of rowsConsumed instead admits BOTH callers (the winner's
+//     increment is visible to the loser's re-read), unsealing two
+//     regulated records under a maxRowsPerGrant:1 grant.
+// ====================================================================
+async function _testBreakGlassConcurrentDoubleClaim(driver) {
+  // A second glass-locked row so the two redemptions target DIFFERENT
+  // rows — a same-row retry can't mask a double-spend.
+  var patient2 = b.cryptoField.sealRow("patients", {
+    _id: "patient-002", mrn: "MRN-2", ssn: "987-65-4321",
+    residency: "eu", notes: "type 2 diabetes",
+  });
+  await b.clusterStorage.execute(
+    'INSERT INTO patients ("_id","mrn","ssn","residency","notes") VALUES (?,?,?,?,?)',
+    [patient2._id, patient2.mrn, patient2.ssn, patient2.residency, patient2.notes]);
+
+  // Fresh 1-row grant — the policy from the previous section already pins
+  // maxRowsPerGrant: 1 (row-by-row auth).
+  var totpSecret = b.auth.totp.generateSecret();
+  var nowMs = Date.now();
+  var code = b.auth.totp.generate(totpSecret, { now: nowMs });
+  var req = {
+    user:    { id: "dr-house", scopes: [] },
+    socket:  { remoteAddress: "127.0.0.1" },
+    headers: { "user-agent": "test-agent" },
+    method:  "POST",
+    url:     "/admin/break-glass",
+  };
+  var handle = await b.breakGlass.grant({
+    req:     req,
+    table:   "patients",
+    columns: ["ssn"],
+    reason:  "ER admit disambiguating two candidate records",
+    factor:  { type: "totp", secret: totpSecret, code: code, now: nowMs },
+  });
+  check("break-glass double-claim: fresh 1-row grant minted (rowsRemaining 1)",
+        handle && handle.rowsRemaining === 1);
+
+  // Hold the grant row's lock from a dedicated raw session so BOTH claim
+  // UPDATEs park behind it — removing every timing assumption: neither
+  // caller can win the slot before both have reached the atomic claim.
+  var holder = await driver.connect();
+  var race = null;
+  try {
+    await driver.query(holder, "BEGIN", []);
+    var locked = await driver.query(holder,
+      'SELECT "_id" FROM _blamejs_break_glass_grants ' +
+      "WHERE \"_id\" = '" + handle.id + "' FOR UPDATE", []);
+    check("break-glass double-claim: holder session locked the grant row",
+          locked.rows.length === 1);
+
+    race = Promise.allSettled([
+      b.breakGlass.unsealRow(handle, "patients", "patient-001"),
+      b.breakGlass.unsealRow(handle, "patients", "patient-002"),
+    ]);
+
+    // Both claim UPDATEs must be observed BLOCKED on the held row lock —
+    // the proof that both callers passed the pre-flight counter check and
+    // committed to the atomic claim before either could win.
+    await helpers.waitUntil(function () {
+      var n = _psql(
+        "SELECT count(*) AS n FROM pg_stat_activity " +
+        "WHERE wait_event_type = 'Lock' " +
+        "AND query LIKE 'UPDATE%_blamejs_break_glass_grants%';").trim();
+      return Number(n) >= 2;
+    }, {
+      timeoutMs: 15000,
+      label:     "break-glass double-claim: both claim UPDATEs blocked on the held grant-row lock",
+    });
+  } finally {
+    try { await driver.query(holder, "COMMIT", []); } catch (_e) { /* best effort */ }
+    try { await driver.close(holder); } catch (_e) { /* best effort */ }
+  }
+
+  var results = await race;
+  var ok  = results.filter(function (r) { return r.status === "fulfilled"; });
+  var bad = results.filter(function (r) { return r.status === "rejected"; });
+  check("break-glass double-claim: exactly ONE of two concurrent unseals " +
+        "succeeded under the 1-row grant on live Postgres",
+        ok.length === 1 && bad.length === 1);
+  check("break-glass double-claim: the winner decrypted its glass-locked ssn",
+        ok.length === 1 &&
+        (ok[0].value.ssn === "123-45-6789" || ok[0].value.ssn === "987-65-4321"));
+  var loser = bad.length === 1 ? bad[0].reason : null;
+  check("break-glass double-claim: the loser is refused as grant-exhausted",
+        loser !== null &&
+        /breakglass\/grant-exhausted/.test(String((loser && loser.code) || "")));
+  // The loser must lose AT THE ATOMIC CLAIM ("exhausted by a concurrent
+  // read" — 0 affected rows), NOT at the pre-flight counter check ("has
+  // consumed all ... allowed rows") — the pre-flight path never raced. A
+  // re-read-based claim admits both callers and neither message appears.
+  check("break-glass double-claim: the loser was refused by the affected-" +
+        "row-count claim, not the pre-flight check [loser: " +
+        String(loser && loser.message) + "]",
+        loser !== null &&
+        /exhausted by a concurrent read/.test(String((loser && loser.message) || "")));
+
+  var spent = _psql('SELECT "rowsConsumed" FROM _blamejs_break_glass_grants ' +
+                    "WHERE \"_id\" = '" + handle.id + "';");
+  check("break-glass double-claim: rowsConsumed on Postgres is exactly 1 — " +
+        "the 1-row grant was spent once, not twice",
+        spent.trim() === "1");
+}
+
 // ====================================================================
 // 6. crypto-field K_row (vault.row:) sealed cell stored on Postgres + read
 //    back, proving the typed codec (Buffer / object / string) survives a

package/lib/vendor/blamejs/test/integration/data-layer-mysql.test.js

@@ -312,6 +312,7 @@ async function run() {
     await _section("session", _testSession);
     await _section("nonce", _testNonceCluster);
     await _section("rate-limit", _testRateLimitCluster);
+    await _section("sql-offset", _testOffsetWithoutLimit);
   } finally {
     try { await b.cluster.shutdown(); } catch (_e) {}
     b.cluster._resetForTest();
@@ -609,6 +610,35 @@ async function _testRateLimitCluster() {
   if (typeof backend.close === "function") backend.close();
 }
 
+// ======================================================================
+// b.sql offset-without-limit sentinel on real MySQL.
+//   A SELECT with .offset(n) and no .limit() emits the max-unsigned-
+//   BIGINT LIMIT sentinel (`LIMIT 18446744073709551615 OFFSET n`) for the
+//   mysql dialect — MySQL rejects a bare OFFSET as a syntax error, so the
+//   sentinel is what makes offset-without-limit run at all. Layer-0 only
+//   string-asserts the mysql emission and executes it live on sqlite;
+//   this PREPARES and RUNS the emitted statement on the live server and
+//   asserts it returns exactly the rows after the offset.
+// ======================================================================
+async function _testOffsetWithoutLimit() {
+  _execMysql("DROP TABLE IF EXISTS `dl_mysql_offset`");
+  _execMysql("CREATE TABLE `dl_mysql_offset` (`a` BIGINT NOT NULL)");
+  _execMysql("INSERT INTO `dl_mysql_offset` VALUES (1),(2),(3),(4),(5)");
+  try {
+    var built = b.sql.select("dl_mysql_offset", { dialect: "mysql", quoteName: true })
+      .columns(["a"]).orderBy("a").offset(2).toSql();
+    softCheck("sql-offset(mysql): offset-without-limit emits the max-BIGINT LIMIT sentinel",
+          built.sql.indexOf("LIMIT 18446744073709551615 OFFSET 2") !== -1);
+    var res = await b.externalDb.query(built.sql, built.params, { backend: "ops" });
+    var got = (res.rows || []).map(function (r) { return Number(r.a); });
+    softCheck("sql-offset(mysql): the emitted offset-only SELECT runs on real MySQL " +
+          "(a bare OFFSET is a syntax error there) and returns exactly the rows after the offset",
+          JSON.stringify(got) === JSON.stringify([3, 4, 5]));
+  } finally {
+    _execMysql("DROP TABLE IF EXISTS `dl_mysql_offset`");
+  }
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/integration/data-layer-pg.test.js

@@ -316,6 +316,7 @@ async function run() {
     await _section("cache", _testCacheCluster);
     await _section("nonce", _testNonceCluster);
     await _section("rate-limit", _testRateLimitCluster);
+    await _section("sql-offset", _testOffsetWithoutLimit);
   } finally {
     try { await b.cluster.shutdown(); } catch (_e) {}
     b.cluster._resetForTest();
@@ -569,6 +570,34 @@ async function _testRateLimitCluster() {
   if (typeof backend.close === "function") backend.close();
 }
 
+// ======================================================================
+// b.sql offset-without-limit sentinel on real Postgres.
+//   A SELECT with .offset(n) and no .limit() emits `LIMIT ALL OFFSET n`
+//   for the postgres dialect (one query text across every backend).
+//   Layer-0 only string-asserts the postgres emission and executes it
+//   live on sqlite; this PREPARES and RUNS the emitted statement on the
+//   live server and asserts it returns exactly the rows after the offset
+//   — proving the LIMIT ALL sentinel is real Postgres syntax.
+// ======================================================================
+async function _testOffsetWithoutLimit() {
+  _psql('DROP TABLE IF EXISTS "dl_pg_offset";');
+  _psql('CREATE TABLE "dl_pg_offset" ("a" INTEGER NOT NULL);\n' +
+        'INSERT INTO "dl_pg_offset" VALUES (1),(2),(3),(4),(5);');
+  try {
+    var built = b.sql.select("dl_pg_offset", { dialect: "postgres", quoteName: true })
+      .columns(["a"]).orderBy("a").offset(2).toSql();
+    softCheck("sql-offset(pg): offset-without-limit emits the LIMIT ALL sentinel",
+          built.sql.indexOf("LIMIT ALL OFFSET 2") !== -1);
+    var res = await b.externalDb.query(built.sql, built.params, { backend: "ops" });
+    var got = (res.rows || []).map(function (r) { return Number(r.a); });
+    softCheck("sql-offset(pg): the emitted offset-only SELECT runs on real Postgres " +
+          "and returns exactly the rows after the offset",
+          JSON.stringify(got) === JSON.stringify([3, 4, 5]));
+  } finally {
+    _psql('DROP TABLE IF EXISTS "dl_pg_offset";');
+  }
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {